CVE-2026-74018

CVE-2026-74018 is an Arbitrary File Upload vulnerability in the WordPress Theme Warehouse Cargo (versions ≤ 2.6.9 ). The vulnerability is accessible to users with Subscriber privileges and carries a CVSS 3.1 score of 9.9 (Critical) , with a vector of AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, indicatin...

EUVD-2026-63318

Subscriber Arbitrary File Upload in Warehouse Cargo = 2.6.9 versions...

EUVD-2026-63316

Subscriber Arbitrary File Upload in IT Residence = 3.2.1 versions...

EUVD-2026-63317

Subscriber Arbitrary File Upload in Smart Cleaning = 4.8.6 versions...

CVE-2026-74016 WordPress Smart Cleaning theme <= 4.8.6 - Arbitrary File Upload vulnerability

Subscriber Arbitrary File Upload in Smart Cleaning = 4.8.6 versions...

CVE-2026-74014

A Subscriber (low-privileged WordPress user) in the IT Residence theme

CVE-2026-74016

The WordPress Smart Cleaning theme (≤4.8.6) allows any logged-in subscriber to upload arbitrary files, enabling remote code execution. Patchstack reports this as critical (CVSS 9.9) with a fix available in newer theme versions; upgrading the theme is the primary mitigation. No in-the-wild exploit...

CVE-2026-74014 WordPress IT Residence theme <= 3.2.1 - Arbitrary File Upload vulnerability

Subscriber Arbitrary File Upload in IT Residence = 3.2.1 versions...

CVE-2026-66600 WordPress Media LIbrary Assistant plugin <= 3.39 - Arbitrary File Upload vulnerability

Author Arbitrary File Upload in Media LIbrary Assistant = 3.39 versions...

EUVD-2026-63341

Author Arbitrary File Upload in Media LIbrary Assistant = 3.39 versions...

CVE-2026-66600

Media Library Assistant WordPress plugin (versions ≤ 3.39) allows users with the Author role to upload arbitrary files, potentially enabling remote code execution. CVSS 9.1 (Critical) reflects network-exploitable, low-complexity attack with full confidentiality, integrity, and availability impact...

WordPress Warehouse Cargo theme <= 2.7.0 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Denver Jackson in WordPress Theme Warehouse Cargo versions = 2.7.0...

CVE-2026-15049

CVE-2026-15049 affects the Depicter — Popup & Slider Builder WordPress plugin in versions prior to 4.8.0 . The plugin's import feature does not validate the type of uploaded files and fails to remove malformed uploads, allowing any user with editor-level access to write an arbitrary file—includin...

CVE-2026-15049 Depicter < 4.8.0 - Editor+ Arbitrary File Upload via ZIP Import

The Depicter — Popup & Slider Builder WordPress plugin before 4.8.0 does not validate the type of a file uploaded through its import feature and does not remove a malformed upload, allowing users with editor-level access to write an arbitrary file including executable PHP into a web-accessible...

PT-2026-80749

Name of the Vulnerable Software and Affected Versions backpack/crud versions 6.0.0 through 6.8.13 backpack/crud versions 7.0.0 through 7.0.37 Description An authenticated administrator can store arbitrary file content on the configured disk. This occurs because the SingleBase64Image::uploadFiles...

PT-2026-78990

Name of the Vulnerable Software and Affected Versions Smart Cleaning versions prior to 4.8.7 Description An arbitrary file upload issue exists that allows users with subscriber privileges to upload unauthorized files to the system. Recommendations Update to a version newer than 4.8.6...

PT-2026-79088

An issue was discovered in vsDesk v14.0101. An authenticated attacker with administrative privileges can bypass client-side file validation in the "Import via CSV" component due to a lack of server-side validation. This allows the upload of an arbitrary file, which can lead to Remote Code Executi...

PT-2026-78989

Name of the Vulnerable Software and Affected Versions IT Residence versions prior to 3.2.2 Description An arbitrary file upload issue exists that allows a subscriber to upload unauthorized files to the system. Recommendations Update to a version newer than 3.2.1...

PT-2026-78991

Name of the Vulnerable Software and Affected Versions Warehouse Cargo versions prior to 2.7.0 Description An issue allows subscribers to perform arbitrary file uploads, which could lead to the upload of unauthorized files to the server. Recommendations Update to a version newer than 2.6.9...

CVE-2026-32475

Elementor Pro WordPress plugin (≈6,000,000 active installations) is vulnerable to unauthenticated arbitrary file upload in all versions up to and including 4.2.1 . The root cause is a logic error in the Upload::validation() function where return is used instead of continue when the first array el...